Manage Endpoint Context CCFR Practice Questions (Page 4)

Questions 16–17

1. 16application · medium

   You are a Falcon responder investigating a potential data exfiltration incident. The compromised host is a managed Windows workstation. In Host Search, you see the Neighbors tab with several hosts. You need to quickly identify which neighbors are managed so you can check them for similar indicators of compromise. What is the most reliable way to distinguish managed from unmanaged neighbors in the Host Search UI?

   • AManaged neighbors have a green checkmark icon next to their hostname.
   • BManaged neighbors display a Falcon sensor version number and a 'Managed by Falcon' label.
   • CManaged neighbors are listed at the top of the Neighbors tab, sorted by IP address.
   • DManaged neighbors show the last seen timestamp, while unmanaged neighbors do not.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   You are investigating a managed host that was compromised. The Neighbors tab shows 10 hosts on the same subnet, 6 managed and 4 unmanaged. You need to assess the risk of lateral movement to the unmanaged hosts. You have no credentials or access to the unmanaged hosts. Which combination of Falcon features will give you the best insight into whether the unmanaged hosts were accessed?

   • AReview the compromised host's Network Connections data and correlate it with the unmanaged hosts' IP addresses from the Neighbors tab.
   • BInitiate a Falcon containment action on the unmanaged hosts to block further access.
   • CUse Falcon's Event Search to look for authentication events from the unmanaged hosts.
   • DRun a Falcon Real Time Response (RTR) script to enumerate the unmanaged hosts' file systems.
   Reveal Solution Discussion Select an answer first